SOC Alerts

1. What is a SOC alert?

A. A system backup notification

B. A notification generated when suspicious or malicious activity is detected

C. A software installation message

D. A user login confirmation email

2. What tools commonly generate SOC alerts?

A. Word processors and spreadsheets

B. Email clients only

C. SIEM, IDS/IPS, EDR, firewalls, and threat intelligence tools

D. Web browsers

3. What is the difference between an event and an alert in SOC terms?

A. Event is any logged activity; alert is a flagged suspicious event

B. Event is malicious, alert is normal activity

C. Both are identical

D. Alert is system log, event is firewall rule

4. Scenario: A SIEM generates an alert for multiple failed login attempts. What could this indicate?

A. Software update process

B. Brute-force attack attempt

C. Normal user behavior

D. Printer malfunction

5. What is alert triage in SOC operations?

A. Ignoring all alerts

B. Deleting log files

C. Reviewing and prioritizing alerts based on severity

D. Blocking all network traffic

6. What are false positive alerts?

A. Alerts that detect real attacks correctly

B. Alerts that indicate system updates

C. Alerts incorrectly identifying harmless activity as malicious

D. Alerts generated manually

7. Scenario: A SOC analyst receives hundreds of low-severity alerts daily. What issue does this cause?

A. System upgrade

B. Improved performance

C. Network failure

D. Alert fatigue

8. What is alert correlation in SOC systems?

A. Deleting duplicate alerts

B. Linking related alerts to identify a single incident

C. Blocking all alerts

9. What is the importance of alert severity levels?

A. To make alerts colorful

B. To stop logging systems

C. To delete low-level alerts automatically

D. To prioritize alerts based on impact